CVE-2021-39272: Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certa...

Security readout for executives and security teams

Fetchmail versions before 6.4.22 may not always enforce STARTTLS encryption. In some mail retrieval sessions, including an IMAP PREAUTH situation, traffic expected to be protected could continue without encryption. This is mainly a confidentiality risk for organizations still using Fetchmail to retrieve mail from external or internal servers. Exposure is likely limited to systems running Fetchmail before 6.4.22, especially where STARTTLS is relied on for mail retrieval encryption. Environments that do not use Fetchmail, or already run a fixed vendor package, are not indicated as affected by the provided sources. Treat this as a targeted mail confidentiality issue, not a broad internet-facing emergency based on available evidence. Prioritize remediation where Fetchmail handles sensitive mailbox retrieval or traverses untrusted networks. Mitigation focus: Upgrade Fetchmail to 6.4.22 or a later vendor-supported package.; Apply relevant distribution updates from Fedora, Gentoo, or your operating-system vendor.; Review Fetchmail configurations that rely on STARTTLS for mail retrieval protection..

Prepared

Jun 2, 2026, 18:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.